6

Suppose you have a tenant with MFA enabled. The same tenant allows users to create private app passwords like on the screenshot below.

enter image description here

Question:

  • Is it possible to use this app password to authenticate against a site using PowerShell PnP?
  • When using this app password, does this app have the same permissions as my account?

This is my attempt to authenticate with the app password, to give you an idea what I am trying to do:

enter image description here

2
  • 1
    Is there a reason you'd want to do this? App Passwords should be disabled as they're a security end-run around Modern Auth. If you need to automate a script, use a client ID/secret with registered application in Azure AD.
    – user6024
    Commented Mar 4, 2020 at 4:51
  • The reason I am asking the question is to learn how this works. I work with many clients and all of them have this feature disabled. However, yesterday I have noticed that this feature is available in one tenant with MFA. I thought why not try to use it. Azure App registrations work great, but it's really hard to get from large clients. I can only dream to get it approved in a bank, for example. Commented Mar 4, 2020 at 11:24

1 Answer 1

4

Yes.

You can use app password to authenticate SharePoint Online site using PowerShell PnP.

Hit below URL:

Connect-PnPOnline -Url https://contoso.sharepoint.com

It will open a pop-up like below where you can pass user username and app password:

enter image description here

And, If you are using:

Connect-PnPOnline -Url https://contoso.sharepoint.com -PnPO365ManagementShell

This will authenticate you using the PnP O365 Management Shell Multi-Tenant application. A browser window will have to be opened where you have to enter a code that is shown in your PowerShell window.

You will get the code in below format

WARNING: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXXXX to authenticate.

And Yes, this will have the same permissions as your account.

Update from Comments:

Try using below code to avoid pop-up asking for App Password:

$username = "[email protected]"
$password = "XXXXXXXXX"

$encpassword = convertto-securestring -String $password -AsPlainText -Force
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $encpassword
Connect-PnPOnline -Url https://contoso.sharepoint.com -Credentials $cred
4
  • Thank you, Ganesh. Is it possible to use the app password without a popup? Commented Mar 4, 2020 at 11:18
  • 1
    Yes, check the updated answer. Commented Mar 4, 2020 at 12:34
  • Seems this has changed and app password do not work anymore. Any more ideas? :|
    – Rohit
    Commented Jun 8, 2021 at 12:27
  • Check this documentation for all authentication cmdlets. Try using Connect-PnPOnline -Url "https://contoso.sharepoint.com" -UseWebLogin or Connect-PnPOnline -Url "https://contoso.sharepoint.com" -Interactive Commented Jun 8, 2021 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.